Problem - Kevin Tafuro

Discussion
Session caching is normally not enabled by default, but enabling it is a relatively
painless process. OpenSSLdoes most of the work for you, although you can override
much of the default behavior (for example, you might build your own caching
mechanism on the server side). By default, OpenSSLuses an in-memory session
cache, but if you will be caching a large number of sessions, or if you want sessions
to persist across boots, you may be better off using some kind of disk-based cache.
Most of the work required to enable session caching has to be done on the server
side, but there’s not all that much that needs to be done:
1. Set a session ID context. The purpose of the session ID context is to make sure
the session is reused for the same purpose for which it was created. For instance,
a session created for an SSLweb server should not be automatically allowed for
an SSLFTP server. A session ID context can be any arbitrary binary data up to
32 bytes in length. There are no requirements for what the data should be, other
than that it should be unique for the purpose your server serves—you don’t
want to find your server getting sessions from other servers.
2. Set a session timeout. The OpenSSLdefault is 300 seconds, which is probably a
reasonable default for most applications. When a session times out, it is not
immediately purged from the server’s cache, but it will not be accepted when
presented by the client. If a client attempts to use an expired session, the server
will remove it from its cache.
3. Set a caching mode. OpenSSLsupports a number of possible mode options,
specified as a bit mask:
SSL_SESS_CACHE_OFF
Setting this mode disables session caching altogether. If you want to disable
session caching, you should specify this flag by itself; you do not need to set
a session ID context or a timeout.
SSL_SESS_CACHE_SERVER
Setting this mode causes sessions that are generated by the server to be
cached. This is the default mode and should be included whenever you’re
setting any of the other flags described here, except for SSL_SESS_CACHE_OFF.
SSL_SESS_CACHE_NO_AUTO_CLEAR
By default, the session cache is checked for expired entries once for every
255 connections that are established. Sometimes this can cause an undesirable
delay, so it may be desirable to disable this automatic flushing of the
cache. If you set this mode, you should make sure that you periodically call
SSL_CTX_flush_sessions( ) yourself.
SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
If you want to replace OpenSSL’s internal caching mechanism with one of
your own devising, you should set this mode. We do not include a recipe
Using Session Caching to Make SSL Servers More Efficient | 461
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.